What is GHSA-3r27-cgcx-x497?

GHSA-3r27-cgcx-x497 is a security advisory published by GitHub Security Advisories with High severity. Renovate versions \u003e= 13.87.0 and \u003c= 19.38.6 leak temporary repository tokens into pull request...

Which CVE IDs does GHSA-3r27-cgcx-x497 cover?

GHSA-3r27-cgcx-x497 covers the following CVE IDs: CVE-2019-25766. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3r27-cgcx-x497?

GHSA-3r27-cgcx-x497 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-3r27-cgcx-x497HighCVSS 7.5

Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request...

Vendor

GitHub Security Advisories

Published

August 19, 2026

Last Modified

August 19, 2026

🔗 CVE IDs covered (1)

CVE-2019-25766 →

📋 Description

Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.

🔗 References (4)

https://github.com/renovatebot/renovate/security/advisories/GHSA-v7x3-7hw7-pcjg
https://nvd.nist.gov/vuln/detail/CVE-2019-25766
https://www.vulncheck.com/advisories/renovate-before-credential-exposure-via-go-modules
https://github.com/advisories/GHSA-3r27-cgcx-x497